Policy Evaluation rejects Constraints created with expanded `leftOperand` about tractusx-edc

[wolf4ood]

Hi @arnoweiss

thanks for raising this, just to check which one is working for you this one?

{
  "@id": "pol-def-id",
  "policy": {
    "@type": "odrl:Set",
    "odrl:permission": {
      "odrl:action": {
        "odrl:type": "http://www.w3.org/ns/odrl/2/use"
      },
      "odrl:constraint": {
        "odrl:and": [
          {
            "odrl:leftOperand": "cx-policy:FrameworkAgreement",
            "odrl:operator": {
              "@id": "odrl:eq"
            },
            "odrl:rightOperand": "traceability:3.0"
          },
          {
            "odrl:leftOperand": "https://w3id.org/catenax/policy/UsagePurpose",
            "odrl:operator": {
              "@id": "odrl:eq"
            },
            "odrl:rightOperand": "cx.core.qualityNotifications:1"
          }
        ]
      }
    },
    "odrl:prohibition": [],
    "odrl:obligation": []
  },
  "@context": {
    "@vocab": "https://w3id.org/edc/v0.0.1/ns/",
    "edc": "https://w3id.org/edc/v0.0.1/ns/",
    "tx": "https://w3id.org/tractusx/v0.0.1/ns/",
    "tx-auth": "https://w3id.org/tractusx/auth/",
    "cx-policy": "https://w3id.org/catenax/policy/",
    "odrl": "http://www.w3.org/ns/odrl/2/"
  }
}

[arnoweiss]

Your payload works as expected, mine doesn't. The UsagePurpose constraint has no influence on the result.

[wolf4ood]

From a quick look seems that what's happening here is that your payload actually works and gets evaluated in the catalog request with permission denied,

while my payload is wrong since the expanded version will be different from your.

 "odrl:leftOperand": "cx-policy:FrameworkAgreement",

"http://www.w3.org/ns/odrl/2/leftOperand": [
   {
       "@value": "cx-policy:FrameworkAgreement"
   }
]

which will not trigger the policy evaluation function.

while yours it's directly expanded and triggers the function

if you want to use the prefix i think you should have

 "odrl:leftOperand": {
     "@id", "cx-policy:FrameworkAgreement",
 }

and should yield the same result (permission denied)

[arnoweiss]

Thanks for hint